cdda7c37d0061c688b44edcd52b320bf1313bb672d396d06650bfdc53f770d50

Analysis

max time kernel
115s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 01:05

Target

cdda7c37d0061c688b44edcd52b320bf1313bb672d396d06650bfdc53f770d50.dll
Size

7KB
MD5

8df0002f0ebbf5292fea62dc041cc6e2
SHA1

d9991810e59f2a0d8384a78c7fb4def9afd653e6
SHA256

cdda7c37d0061c688b44edcd52b320bf1313bb672d396d06650bfdc53f770d50
SHA512

29104e61323656a6a571efce804bb1326cb2da4bf0d250962352c8a0e8db3be958f15b074fe98c5e143be815a3cf0d9496ffb3a4dffe6b2373ee0c0e70254729
SSDEEP

48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWxbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPvq3qX5S2hV

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4400	1172	rundll32.exe	92
PID 1172 wrote to memory of 4400	1172	rundll32.exe	92
PID 1172 wrote to memory of 4400	1172	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdda7c37d0061c688b44edcd52b320bf1313bb672d396d06650bfdc53f770d50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cdda7c37d0061c688b44edcd52b320bf1313bb672d396d06650bfdc53f770d50.dll,#1
  2⤵
  PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4148 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:3760